[Bug nss/27485] New: Updating from 2.31 to 2.32 causes bash to SIGSEGV

[Bug nss/27485] New: Updating from 2.31 to 2.32 causes bash to SIGSEGV

[josephriches at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27485

            Bug ID: 27485
           Summary: Updating from 2.31 to 2.32 causes bash to SIGSEGV
           Product: glibc
           Version: 2.32
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: nss
          Assignee: unassigned at sourceware dot org
          Reporter: josephriches at gmail dot com
  Target Milestone: ---

bash version 5.1 (patch level 004)

Not sure where to really start with this, tried a build at 469c039 before the
libnss work landed in 2.32 and from master but same issue, haven't bisected
further.

```
Reading symbols from bash...
Reading symbols from
/usr/lib64/debug/.build-id/b6/c12c0bbaee3eae158905bd42199eb10ae5a8c9.debug...
(gdb) run
Starting program: /bin/bash 

Program received signal SIGSEGV, Segmentation fault.
0x00007fffeaa06c6d in __GI___nss_readline (fp=fp@entry=0x7fffea7c52a0,
buf=buf@entry=0x62aab0 "root:x:0:0:root:/root:/bin/bash\n", len=len@entry=1024,
poffset=poffset@entry=0x7fffffffe040) at nss_readline.c:68
68      nss_readline.c: No such file or directory.
(gdb) bt
#0  0x00007fffeaa06c6d in __GI___nss_readline (fp=fp@entry=0x7fffea7c52a0,
buf=buf@entry=0x62aab0 "root:x:0:0:root:/root:/bin/bash\n", len=len@entry=1024,
poffset=poffset@entry=0x7fffffffe040) at nss_readline.c:68
#1  0x00007fffeaaae292 in internal_getent (stream=0x7fffea7c52a0,
result=result@entry=0x603520 <resbuf>, buffer=buffer@entry=0x62aab0
"root:x:0:0:root:/root:/bin/bash\n", buflen=buflen@entry=1024,
errnop=errnop@entry=0x605870)
    at nss_files/files-XXX.c:152
#2  0x00007fffeaaae5aa in _nss_files_getpwuid_r (uid=1000, result=0x603520
<resbuf>, buffer=0x62aab0 "root:x:0:0:root:/root:/bin/bash\n", buflen=1024,
errnop=0x605870) at nss_files/files-pwd.c:42
#3  0x0000000000504e59 in getpwuid_r ()
#4  0x000000000050458d in getpwuid ()
#5  0x0000000000404dc3 in get_current_user_info () at ../shell.c:1880
#6  get_current_user_info () at ../shell.c:1870
#7  0x0000000000404fdc in shell_initialize () at ../shell.c:1943
#8  0x0000000000402acf in main (argc=1, argv=0x7fffffffe618,
env=0x7fffffffe628) at ../shell.c:572
(gdb) list
63      in nss_readline.c
(gdb) print __GI___nss_readline
$1 = {int (FILE *, char *, size_t, off64_t *)} 0x7fffeaa06bfa
<__GI___nss_readline>
(gdb) print getpwuid_r
$2 = {<text variable, no debug info>} 0x504d10 <getpwuid_r>
(gdb) disassemble
Dump of assembler code for function __GI___nss_readline:
   0x00007fffeaa06bfa <+0>:     endbr64 
   0x00007fffeaa06bfe <+4>:     push   %r15
   0x00007fffeaa06c00 <+6>:     push   %r14
   0x00007fffeaa06c02 <+8>:     push   %r13
   0x00007fffeaa06c04 <+10>:    push   %r12
   0x00007fffeaa06c06 <+12>:    push   %rbp
   0x00007fffeaa06c07 <+13>:    push   %rbx
   0x00007fffeaa06c08 <+14>:    sub    $0x8,%rsp
   0x00007fffeaa06c0c <+18>:    mov    %rdi,%r13
   0x00007fffeaa06c0f <+21>:    mov    %rsi,%rbp
   0x00007fffeaa06c12 <+24>:    mov    %rdx,%r12
   0x00007fffeaa06c15 <+27>:    mov    %rcx,%r14
   0x00007fffeaa06c18 <+30>:    lea    -0x1(%rsi,%rdx,1),%r15
   0x00007fffeaa06c1d <+35>:    cmp    $0x2,%rdx
   0x00007fffeaa06c21 <+39>:    jbe    0x7fffeaa06cc1 <__GI___nss_readline+199>
   0x00007fffeaa06c27 <+45>:    mov    %r13,%rdi
   0x00007fffeaa06c2a <+48>:    call   0x7fffea96b61d <__GI___ftello>
   0x00007fffeaa06c2f <+53>:    mov    %rax,(%r14)
   0x00007fffeaa06c32 <+56>:    movb   $0xff,(%r15)
   0x00007fffeaa06c36 <+60>:    mov    %r13,%rdx
   0x00007fffeaa06c39 <+63>:    mov    %r12d,%esi
   0x00007fffeaa06c3c <+66>:    mov    %rbp,%rdi
   0x00007fffeaa06c3f <+69>:    call   0x7fffea96c95b <__GI___fgets_unlocked>
   0x00007fffeaa06c44 <+74>:    test   %rax,%rax
   0x00007fffeaa06c47 <+77>:    je     0x7fffeaa06cdd <__GI___nss_readline+227>
   0x00007fffeaa06c4d <+83>:    cmpb   $0xff,(%r15)
   0x00007fffeaa06c51 <+87>:    jne    0x7fffeaa06d1b <__GI___nss_readline+289>
   0x00007fffeaa06c57 <+93>:    mov    0x9a17a(%rip),%rax        #
0x7fffeaaa0dd8
   0x00007fffeaa06c5e <+100>:   mov    %fs:(%rax),%rcx
   0x00007fffeaa06c62 <+104>:   movzbl 0x0(%rbp),%eax
   0x00007fffeaa06c66 <+108>:   movsbq %al,%rdx
   0x00007fffeaa06c6a <+112>:   mov    %rbp,%rbx
=> 0x00007fffeaa06c6d <+115>:   testb  $0x20,0x1(%rcx,%rdx,2)
   0x00007fffeaa06c72 <+120>:   je     0x7fffeaa06c85 <__GI___nss_readline+139>
   0x00007fffeaa06c74 <+122>:   inc    %rbx
   0x00007fffeaa06c77 <+125>:   movzbl (%rbx),%eax
   0x00007fffeaa06c7a <+128>:   movsbq %al,%rdx
   0x00007fffeaa06c7e <+132>:   testb  $0x20,0x1(%rcx,%rdx,2)
   0x00007fffeaa06c83 <+137>:   jne    0x7fffeaa06c74 <__GI___nss_readline+122>
   0x00007fffeaa06c85 <+139>:   test   %al,%al
   0x00007fffeaa06c87 <+141>:   je     0x7fffeaa06c27 <__GI___nss_readline+45>
   0x00007fffeaa06c89 <+143>:   cmp    $0x23,%al
   0x00007fffeaa06c8b <+145>:   je     0x7fffeaa06c27 <__GI___nss_readline+45>
   0x00007fffeaa06c8d <+147>:   mov    $0x0,%eax
   0x00007fffeaa06c92 <+152>:   cmp    %rbx,%rbp
   0x00007fffeaa06c95 <+155>:   je     0x7fffeaa06cb2 <__GI___nss_readline+184>
   0x00007fffeaa06c97 <+157>:   mov    %rbx,%rdi
   0x00007fffeaa06c9a <+160>:   call   0x7fffea917480 <*ABS*+0x89d6a@plt>
   0x00007fffeaa06c9f <+165>:   mov    %rax,%rdx
   0x00007fffeaa06ca2 <+168>:   mov    %rbx,%rsi
   0x00007fffeaa06ca5 <+171>:   mov    %rbp,%rdi
   0x00007fffeaa06ca8 <+174>:   call   0x7fffea917640 <*ABS*+0x8a90d@plt>
   0x00007fffeaa06cad <+179>:   mov    $0x0,%eax
--Type <RET> for more, q to quit, c to continue without paging--
   0x00007fffeaa06cb2 <+184>:   add    $0x8,%rsp
   0x00007fffeaa06cb6 <+188>:   pop    %rbx
   0x00007fffeaa06cb7 <+189>:   pop    %rbp
   0x00007fffeaa06cb8 <+190>:   pop    %r12
   0x00007fffeaa06cba <+192>:   pop    %r13
   0x00007fffeaa06cbc <+194>:   pop    %r14
   0x00007fffeaa06cbe <+196>:   pop    %r15
   0x00007fffeaa06cc0 <+198>:   ret    
   0x00007fffeaa06cc1 <+199>:   movq   $0xffffffffffffffff,(%rcx)
   0x00007fffeaa06cc8 <+206>:   mov    0x9a181(%rip),%rax        #
0x7fffeaaa0e50
   0x00007fffeaa06ccf <+213>:   movl   $0x22,%fs:(%rax)
   0x00007fffeaa06cd6 <+220>:   mov    $0x22,%eax
   0x00007fffeaa06cdb <+225>:   jmp    0x7fffeaa06cb2 <__GI___nss_readline+184>
   0x00007fffeaa06cdd <+227>:   testb  $0x10,0x0(%r13)
   0x00007fffeaa06ce2 <+232>:   jne    0x7fffeaa06cfd <__GI___nss_readline+259>
   0x00007fffeaa06ce4 <+234>:   mov    0x9a165(%rip),%rax        #
0x7fffeaaa0e50
   0x00007fffeaa06ceb <+241>:   cmpl   $0x22,%fs:(%rax)
   0x00007fffeaa06cef <+245>:   je     0x7fffeaa06d12 <__GI___nss_readline+280>
   0x00007fffeaa06cf1 <+247>:   mov    0x9a158(%rip),%rax        #
0x7fffeaaa0e50
   0x00007fffeaa06cf8 <+254>:   mov    %fs:(%rax),%eax
   0x00007fffeaa06cfb <+257>:   jmp    0x7fffeaa06cb2 <__GI___nss_readline+184>
   0x00007fffeaa06cfd <+259>:   mov    0x9a14c(%rip),%rax        #
0x7fffeaaa0e50
   0x00007fffeaa06d04 <+266>:   movl   $0x2,%fs:(%rax)
   0x00007fffeaa06d0b <+273>:   mov    $0x2,%eax
   0x00007fffeaa06d10 <+278>:   jmp    0x7fffeaa06cb2 <__GI___nss_readline+184>
   0x00007fffeaa06d12 <+280>:   movl   $0x16,%fs:(%rax)
   0x00007fffeaa06d19 <+287>:   jmp    0x7fffeaa06cf1 <__GI___nss_readline+247>
   0x00007fffeaa06d1b <+289>:   mov    (%r14),%rsi
   0x00007fffeaa06d1e <+292>:   mov    %r13,%rdi
   0x00007fffeaa06d21 <+295>:   call   0x7fffeaa06bb2 <__nss_readline_seek>
   0x00007fffeaa06d26 <+300>:   jmp    0x7fffeaa06cb2 <__GI___nss_readline+184>
End of assembler dump.
(gdb) quit
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nss/27485] 2.32 causes bash to SIGSEGV

[josephriches at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27485

Joey Riches <josephriches at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |josephriches at gmail dot com
            Summary|Updating from 2.31 to 2.32  |2.32 causes bash to SIGSEGV
                   |causes bash to SIGSEGV      |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nss/27485] 2.32 causes bash to SIGSEGV

[josephriches at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27485

--- Comment #1 from Joey Riches <josephriches at gmail dot com> ---
Bisected to: ec935de elf: Implement __libc_early_init

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nss/27485] 2.32 causes bash to SIGSEGV

[josephriches at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27485

Joey Riches <josephriches at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |NOTABUG
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #2 from Joey Riches <josephriches at gmail dot com> ---
Ah figured it out, it seemed only affected a static built bash so

1. build/install bash as dynamically linked
2. build/install glibc
3. rebuildinstall statically built bash

I'm guessing everything statically linked will need to be rebuilt for this
release.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nss/27485] 2.32 causes bash to SIGSEGV

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27485

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Joey Riches from comment #2)
> I'm guessing everything statically linked will need to be rebuilt for this
> release.

Everything statically linked using NSS needs to be rebuilt. But that happens
for most releases.

-- 
You are receiving this mail because:
You are on the CC list for the bug.